Executive brief
NI grpc-device is a software component used to interface with National Instruments hardware over a network. A security flaw exists where the system may fail to require authentication if it is configured without encryption (TLS) and is accessible beyond the local computer. This could allow an unauthorized person on the same network to gain full control over the device server, potentially leading to the theft of sensitive measurement data or unauthorized manipulation of hardware operations.
Technical details
The vulnerability is classified as Missing Authentication for Critical Function (CWE-306). In NI grpc-device versions 2.17.0 and prior, the software fails to enforce credentials when a TLS configuration is absent and the server is bound to a network interface other than the loopback address (127.0.0.1). An unauthenticated attacker on the local network can exploit this to gain unauthorized access to the gRPC server. This provides the attacker with high confidentiality and integrity impact over the device's functions. The issue is addressed in NI grpc-device version 2.18.0.
Affected products
- NI grpc-device <= 2.17.0
- NI InstrumentStudio <= 26.3.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 2.18.0